fedipod 0.13.0 → 0.14.0

package/README.md

@@ -1,13 +1,13 @@
 # FediPod
 
-- access the fediverse from a Solid pod
+- access the Fediverse from a Solid pod
 
 `FediPod` is a merger of three federating protocols - feeds from Mastodon and other Fediverse servers and from Bluesky and other ATProto servers, with all user data stored on a Solid pod. There are four different kinds of FediPod accounts :
 
 | Kind of Account | Description | User requirements | Host requirements |
 |---|---|---|---|
-| FediPod Solo | Browse & interact with the fediverse and ATProto from a Solid pod | an always-on pod, a usually on local agent | — |
-| FediPod Group | Host a discussion group of fediverse/ATProto users from a Solid pod | an always-on pod, a usually on local agent | — |
+| FediPod Solo | Browse & interact with the Fediverse and ATProto from a Solid pod | an always-on pod, a usually on local agent | — |
+| FediPod Group | Host a discussion group of Fediverse/ATProto users from a Solid pod | an always-on pod, a usually on local agent | — |
 | FediPod Gateway | Solo or Group with spam filtering & optional community identity | same + gateway pass-through account | any always-on host, Netlify will do |
 | FediPod Server | Full ActivityPub server as a CSS component | a pod on a CSS server implementing the FediPod component | a CSS server implementing the FediPod component |
 
@@ -51,7 +51,7 @@ does the same from the terminal. `AP_UPDATE_CHECK=0` turns the check off.
 
 ## A FediPod.net Gateway account (reccommended)
 
-Most of what a fediverse inbox receives is broadcast noise. A gateway is a
+Most of what a Fediverse inbox receives is broadcast noise. A gateway is a
 shared, always-on door that verifies each delivery, drops the junk, and
 passes the rest to your pod — while your key and data stay on your own
 pod. There is a free gateway at [fedipod.net](https://fedipod.net/). Attaching to it or detaching from it is a few wizard-guided clicks.
@@ -61,7 +61,7 @@ Users are recommended to associate with a gateway as it reduces the mail load on
 ## Fediverse Clients
 
 The UI is the bundled [Phanpy](https://github.com/cheeaun/phanpy)
-client (MIT, by Chee Aun). It is served same-origin over the agent's Mastodon client-API facade. Log in with one click, using `https://localhost:8030` (or your own port) as the instance.
+client (MIT, by Chee Aun). It is served same-origin over the agent's Mastodon client-API facade, and logging in is one click — the instance is filled in for you. If you ever enter it by hand, use the address on the record's **local host** row.
 
 The agent federates for real: follow/unfollow, post, reply, favourite,
 boost, media, delete; incoming boosts from people you follow and a
@@ -85,7 +85,12 @@ notifications that reach you while the client is closed.
 
 ## Bluesky and ATProto
 
-`FediPod` includes experimental support for ATProto. A Bluesky connection lets your `FediPod` agent drive an existing Bluesky (or other ATProto) account alongside your fediverse identity. When you post a public post from `FediPod`, it will be cross-posted to Bluesky as a mirror (a toggle you can turn off). Private DMs from `FediPod` to Bluesky are not currently supported.  Bluesky replies and activity flow into your timeline so you see, for example, a combined Bluesky and Mastodon feed.  You can like, boost, and reply to Bluesky posts from within `FediPod`.  None of these features require `Bridgy Fed`, however, fully joining a `FediPod` group from a Bluesky client other than `FediPod` does require a bridge.
+`FediPod` includes experimental support for ATProto. A Bluesky connection lets your `FediPod` agent drive an existing Bluesky (or other ATProto) account alongside your Fediverse identity. When you post a public post from `FediPod`, it will be cross-posted to Bluesky as a mirror (a toggle you can turn off). Private DMs from `FediPod` to Bluesky are not currently supported.  Bluesky replies and activity flow into your timeline so you see, for example, a combined Bluesky and Mastodon feed.  You can like, boost, and reply to Bluesky posts from within `FediPod`.  None of these features require `Bridgy Fed`, however, fully joining a `FediPod` group from a Bluesky client other than `FediPod` does require a bridge.
+
+## Your other Fediverse accounts
+
+If you also hold an account on Mastodon — or on any other server speaking the Mastodon API, such as GoToSocial, Pleroma, Akkoma, Pixelfed or Friendica — you can connect it and read it here. Its home timeline and notifications join the feed you already read, interleaved by time, and a post both accounts see appears once rather than twice. Favouriting, boosting and replying act as the account the post came through, on its own server. Connect one from the **Other identities** row of the admin page: you sign in at that server, and the token it hands back stays on this machine.
+
 
 ## Architecture
 
@@ -112,7 +117,7 @@ as owner-only documents. See [Groups](https://github.com/jeff-zucker/FediPod/blo
 
 ## Acknowledgements
 
-This project is inspired by the fantastic [ActivityPods project](https://github.com/activitypods) and is meant to be a lightweight alternative rather than a replacement.  Thanks to [Sébastien](https://github.com/srosset81) and collaborators for all your work.  Thanks to [Damon](https://github.com/outlaw-dame), [Mikhal](https://github.com/mrkvon), [Alain](https://github.com/bourgeoa), [Sharon](https://github.com/SharonStrats), and [Vincent](https://github.com/Vinnl) for testing and encouragement.  Special thanks are due to [Joseph](https://github.com/jg10-mastodon-social) whose client-to-server authentication approach and the netlify/fronted-identity ideas I borrowed from [solid-activitypub-netlify](https://github.com/jg10-mastodon-social/solid-activitypub-netlify).
+This project is inspired by the fantastic [ActivityPods project](https://github.com/activitypods) and is meant to be a lightweight alternative rather than a replacement.  Thanks to [Sébastien](https://github.com/srosset81) and collaborators for all your work.  Thanks to [Damon](https://github.com/outlaw-dame), [Mikhal](https://github.com/mrkvon), [Alain](https://github.com/bourgeoa), and [Sharon](https://github.com/SharonStrats), for testing and encouragement.  Special thanks are due to [Joseph](https://github.com/jg10-mastodon-social) whose client-to-server authentication approach and the netlify/fronted-identity ideas I borrowed from [solid-activitypub-netlify](https://github.com/jg10-mastodon-social/solid-activitypub-netlify) and to [Vincent](https://github.com/Vinnl) and [Emilia](https://github.com/ThisIsMissEm) whose ideas on the multiple Fediverse accounts sparked FediPod's support for it.
 
 ## Transparency
 

package/bin/fedipod.mjs

@@ -505,7 +505,7 @@ if (cmd === 'up') {
     if (/^y/i.test(have)) {
       // Either tuck the fediverse account into the pod they already have,
       // or make a fresh pod on the same Solid account for it.
-      const where = await ask('store your fediverse account in that pod, or in a new pod? (existing/new)', 'existing');
+      const where = await ask('store your Fediverse account in that pod, or in a new pod? (existing/new)', 'existing');
       if (/^n/i.test(where)) newAccount = true;
       else pod = await ask('your pod address (e.g. https://you.solidcommunity.net/)');
     } else {
@@ -575,8 +575,8 @@ if (cmd === 'up') {
   }
   console.log('The display name can be changed later; the handle and pod cannot.');
   const go = await ask(newAccount
-    ? (kind === 'group' ? 'create pod and group? (y/n)' : 'create pod and fediverse account? (y/n)')
-    : (kind === 'group' ? 'create group on this pod? (y/n)' : 'create fediverse account on this pod? (y/n)'), 'y');
+    ? (kind === 'group' ? 'create pod and group? (y/n)' : 'create pod and Fediverse account? (y/n)')
+    : (kind === 'group' ? 'create group on this pod? (y/n)' : 'create Fediverse account on this pod? (y/n)'), 'y');
   if (!/^y/i.test(go)) { console.log('nothing was created'); process.exit(0); }
   endAsking();                           // hand the tty to the password prompt
 
@@ -589,7 +589,7 @@ if (cmd === 'up') {
     console.log(`account + pod created: ${pod}`);
     if (!webfingerHost(pod)) {
       console.log(`\n${issuerHost} created the pod at a path rather than on its own subdomain,`);
-      console.log(`so @${handle}@\u2026 cannot be discovered by other fediverse servers.`);
+      console.log(`so @${handle}@\u2026 cannot be discovered by other Fediverse servers.`);
       const cont = kind === 'group' ? 'n' : (interactive ? await ask('continue anyway? (y/n)', 'n') : 'y');
       endAsking();
       if (!/^y/i.test(cont)) {

package/groups.md

@@ -68,15 +68,15 @@ A group can be handed on rather than abandoned using the `Transfer this account
 
 A group with a connected Bluesky account is joinable from Bluesky: following
 the group's Bluesky account is a join, and mentioning its handle submits a
-post. Both pass through the same moderation settings as fediverse members —
+post. Both pass through the same moderation settings as Fediverse members —
 join review, post review, and muting all apply, and an approved post is
 carried to the group's Bluesky followers as a repost.
 A follow from an already-bridged Bluesky account is ignored on the Bluesky
 side — its join arrives over ActivityPub from the bridge instead. Carrying
-fediverse posts to the group's Bluesky followers happens only while
+Fediverse posts to the group's Bluesky followers happens only while
 crossposting is on.
 
-A Bluesky member's posts reach the fediverse side only if their account is
+A Bluesky member's posts reach the Fediverse side only if their account is
 bridged (it follows @ap.brid.gy on Bluesky). Unbridged members are welcomed
 with a single post mentioning them explaining that, and everything else about their
 membership still works, and bridging later upgrades them in place: the

package/gui.md

@@ -45,7 +45,7 @@ Each identity has a page anyone can open, at `ap/profile.html` under its pod
 shows the name, bio and address, and offers a Follow box: a visitor types
 their own server and lands on that server's follow screen. Hand out that
 link, or the `@name@host` address itself, which works in the search box of
-any fediverse app.
+any Fediverse app.
 
 ## Bluesky
 
@@ -55,13 +55,39 @@ ones), deleting a post deletes its Bluesky copy, and the account's timeline
 and notifications appear in your home feed. Replying to, favouriting and
 boosting a Bluesky post act as the connected account. A reply lives on
 Bluesky only — it is always public and fits Bluesky's 300-character limit —
-because your fediverse followers cannot see the post it answers. The
+because your Fediverse followers cannot see the post it answers. The
 **crosspost** control stops the
 mirroring without disconnecting. Disconnecting forgets the login but removes
 nothing already posted. For a group, the connected account is the group's
 presence on Bluesky — joining and posting through it follow the group's own
 moderation settings; see [Groups](groups.md).
 
+## Your other Fediverse accounts
+
+Connecting an account you hold on another server brings its home timeline and
+its notifications into the feed you already read here, interleaved by time.
+Mastodon, GoToSocial, Pleroma, Akkoma, Pixelfed and Friendica all work. You
+sign in at that server rather than here: this agent never sees a password, and
+the token it is given stays on this machine and is never written to your pod.
+
+Favouriting, boosting or replying to one of those posts acts **as that
+account**, on its own server, because that is where the conversation is. A
+reply from a connected account is public or unlisted. A post you wrote on that
+account can be deleted from here, and it is deleted where it lives.
+
+A post that two of your accounts both see appears once, not twice. The
+favourite and boost controls are lit when any of your accounts has done it, so
+using one again undoes it everywhere rather than adding a second from a second
+account.
+
+What arrives is held on this machine for reading. None of it is written to your
+pod and none of it is republished — your own posts still go out from your pod
+account alone.
+
+Disconnecting stops the reading and removes the stored token; nothing already
+posted is touched. If the other server stops accepting the token, the account
+is marked **sign in again** rather than quietly dropped.
+
 ## Handling follow requests
 
 New followers appear under **Follow requests** with **Accept** and **Refuse**

package/lib/acctfeed.mjs

@@ -0,0 +1,257 @@
+// acctfeed.mjs — polls each connected fediverse account's home timeline and
+// notifications and merges them into the statuses index as kind 'acct'. View
+// cache only: none of it is written to the pod, which holds followed and own
+// content. Modeled on bskyfeed.mjs, which is modeled on tagfeed.mjs.
+//
+// A note is NOT re-fetched at its origin before being stored. The dereference
+// rule guards material an unauthenticated stranger chose for us; this is the
+// owner's own authenticated account answering with the result of the owner's
+// own follow decisions there — the same trust anchor that lets bskyfeed skip
+// it. A local block still applies, because that is the owner's decision.
+//
+// Config in fediacctfeed.json: { intervalMin, accounts: { <id>: marks } }.
+
+import { sanitizeHtml } from './wire.mjs';
+
+const DEFAULTS = { intervalMin: 5 };
+const PER_SWEEP = 40;
+const MAX_PER_ACCT = 150;
+const MAX_ACCT_ENTRIES = 400;
+const BACKOFF_MIN_MS = 5 * 60_000;
+const BACKOFF_MAX_MS = 2 * 60 * 60_000;
+// Mastodon allows 300 requests per five minutes per token. Four go per sweep,
+// so the floor is only ever reached by something else using the same token.
+const RATE_FLOOR = 20;
+
+const MEDIA_TYPES = {
+  image: 'image/jpeg', gifv: 'image/gif', video: 'video/mp4', audio: 'audio/mpeg',
+};
+
+export class AcctFeed {
+  constructor({ store, accounts, log = console.log, onNotification = null }) {
+    Object.assign(this, { store, accounts, log, onNotification });
+    this.state = new Map();          // account id → { failures, quietUntil }
+    this.lastSweep = null;
+    this.lastAdded = 0;
+  }
+
+  config() { return { ...DEFAULTS, ...this.store.read('fediacctfeed.json', {}) }; }
+
+  setConfig(patch) {
+    const clean = {};
+    if (patch.intervalMin) clean.intervalMin = Math.max(1, Number(patch.intervalMin) || DEFAULTS.intervalMin);
+    this.store.write('fediacctfeed.json', { ...this.config(), ...clean });
+    this.stop();
+    this.start();
+    return this.config();
+  }
+
+  marks(id) { return this.config().accounts?.[id] || {}; }
+
+  setMarks(id, patch) {
+    const cfg = this.config();
+    this.store.write('fediacctfeed.json', {
+      ...cfg, accounts: { ...(cfg.accounts || {}), [id]: { ...(cfg.accounts?.[id] || {}), ...patch } },
+    });
+  }
+
+  start() {
+    this.stopped = false;
+    this.sweep().catch(e => this.log(`acctfeed: ${e.message}`));
+    const tick = () => {
+      this.timer = setTimeout(() => {
+        this.sweep()
+          .catch(e => this.log(`acctfeed: ${e.message}`))
+          .finally(() => { if (!this.stopped) tick(); });
+      }, Math.round(this.config().intervalMin * 60_000 * (0.85 + Math.random() * 0.3)));
+      this.timer.unref?.();
+    };
+    tick();
+  }
+
+  stop() { this.stopped = true; clearTimeout(this.timer); }
+
+  // Per account, not per feed: one server being down must not silence the rest.
+  _stateOf(id) {
+    if (!this.state.has(id)) this.state.set(id, { failures: 0, quietUntil: 0 });
+    return this.state.get(id);
+  }
+
+  _backOff(id, handle, status, retryAfter) {
+    const st = this._stateOf(id);
+    st.failures += 1;
+    const ladder = Math.min(BACKOFF_MIN_MS * 2 ** (st.failures - 1), BACKOFF_MAX_MS);
+    const wait = retryAfter || Math.round(ladder * (0.85 + Math.random() * 0.3));
+    st.quietUntil = Date.now() + wait;
+    this.log(`acctfeed: ${handle} ${status ? `answered ${status}` : 'did not answer'} — not asking again for ${Math.round(wait / 60_000)} min`);
+  }
+
+  // One author into the shared actor cache. `uri` is the ActivityPub id, so a
+  // person the pod already knows from its own inbox stays one actor here.
+  _rememberAuthor(a) {
+    const url = a?.uri || a?.url;
+    if (!url) return null;
+    if (!this.store.getActors()[url]) {
+      this.store.cacheActor(url, {
+        name: a.display_name || a.username, preferredUsername: a.username,
+        icon: a.avatar || null, type: a.bot ? 'Service' : 'Person',
+      });
+    }
+    return url;
+  }
+
+  // One Mastodon status into the statuses index. Never pre-checks for a
+  // duplicate: a repeat sighting is what carries the second account's
+  // provenance, and addStatus is the only thing that knows how to merge it.
+  _mirror(st, { acct, via = null, parents = null }) {
+    const noteId = st.uri;
+    if (!noteId) return false;
+    const actor = this._rememberAuthor(st.account);
+    if (!actor || this.store.isBlocked(actor)) return false;
+    const inReplyTo = st.in_reply_to_id ? parents?.get(String(st.in_reply_to_id)) : null;
+    const out = this.store.addStatus({
+      noteId, actor,
+      content: sanitizeHtml(st.content || ''),
+      published: st.created_at,
+      kind: 'acct',
+      sourceAccts: [{ acct, remoteId: String(st.id) }],
+      ...(st.url && st.url !== noteId ? { link: st.url } : {}),
+      ...(inReplyTo ? { inReplyTo } : {}),
+      ...(via ? { via } : {}),
+      ...(st.spoiler_text ? { spoiler: st.spoiler_text } : {}),
+      ...(st.media_attachments?.length ? {
+        attachments: st.media_attachments.map(m => ({
+          url: m.url, mediaType: MEDIA_TYPES[m.type] || 'image/jpeg', description: m.description || '',
+        })),
+      } : {}),
+    });
+    return !!out?.added;
+  }
+
+  // Mastodon threads by its own local ids, which mean nothing anywhere else.
+  // A parent we already hold from this same account can be resolved locally,
+  // and one we do not hold simply has no parent here rather than a fetch.
+  _parentMap(acct) {
+    const map = new Map();
+    for (const s of this.store.getStatuses()) {
+      for (const v of s.sourceAccts || []) {
+        if (v.acct === acct && v.remoteId) map.set(String(v.remoteId), s.noteId);
+      }
+    }
+    return map;
+  }
+
+  _rateGuard(id, handle, res) {
+    const left = Number(res.headers.get('x-ratelimit-remaining'));
+    if (!Number.isFinite(left) || left > RATE_FLOOR) return false;
+    const reset = Date.parse(res.headers.get('x-ratelimit-reset') || '');
+    const wait = Number.isFinite(reset) ? Math.max(0, reset - Date.now()) : BACKOFF_MIN_MS;
+    this._stateOf(id).quietUntil = Date.now() + wait;
+    this.log(`acctfeed: ${handle} has ${left} requests left — waiting ${Math.round(wait / 1000)}s`);
+    return true;
+  }
+
+  async sweep() {
+    const rows = (this.accounts?.list() || []).filter(r => r.token && r.enabled !== false);
+    if (!rows.length) return;
+    this.lastSweep = new Date().toISOString();
+    let added = 0;
+    // The 300ms debounce cannot coalesce a sweep that awaits between items —
+    // every fetch outlives it — so the whole sweep is one commit boundary.
+    // Without this, statuses.json is serialized whole once per post.
+    this.store.hold();
+    try {
+      for (const rec of rows) {
+        if (this.stopped) break;
+        added += await this._sweepOne(rec).catch((e) => {
+          this._backOff(rec.id, rec.handle, e.status || 0, null);
+          return 0;
+        });
+      }
+      this._prune();
+    } finally {
+      this.store.release();
+    }
+    this.lastAdded = added;
+    if (added) this.log(`acctfeed: +${added} from ${rows.length} connected account(s)`);
+  }
+
+  async _sweepOne(rec) {
+    const st = this._stateOf(rec.id);
+    if (st.quietUntil && Date.now() < st.quietUntil) return 0;
+    const marks = this.marks(rec.id);
+    const parents = this._parentMap(rec.id);
+    let added = 0;
+
+    const homeQ = marks.homeSinceId ? `&since_id=${encodeURIComponent(marks.homeSinceId)}` : '';
+    const homeRes = await this.accounts.api(rec.id, `/api/v1/timelines/home?limit=${PER_SWEEP}${homeQ}`);
+    if (this._rateGuard(rec.id, rec.handle, homeRes)) return 0;
+    const home = await homeRes.json().catch(() => []);
+    if (!Array.isArray(home)) throw new Error(`${rec.handle} answered with no timeline`);
+    for (const item of home) {
+      if (item?.reblog) {
+        // A boost: the inner post is the content, the booster is the carrier —
+        // the same envelope statusOrBoost already renders for our own timeline.
+        const via = this._rememberAuthor(item.account);
+        if (this._mirror(item.reblog, { acct: rec.id, via, parents })) added++;
+      } else if (item?.uri) {
+        if (this._mirror(item, { acct: rec.id, parents })) added++;
+      }
+    }
+    // Mastodon returns newest first, so the first row is the new mark.
+    // Ids are 19-digit snowflakes: opaque strings, never numbers.
+    if (home.length && home[0]?.id) this.setMarks(rec.id, { homeSinceId: String(home[0].id) });
+
+    const notifQ = marks.notifSinceId ? `&since_id=${encodeURIComponent(marks.notifSinceId)}` : '';
+    const notifRes = await this.accounts.api(rec.id, `/api/v1/notifications?limit=${PER_SWEEP}${notifQ}`);
+    if (this._rateGuard(rec.id, rec.handle, notifRes)) return added;
+    const notes = await notifRes.json().catch(() => []);
+    if (Array.isArray(notes)) {
+      for (const n of notes) {
+        if (!n?.account || String(n.account.id) === String(rec.accountId)) continue;
+        const actor = this._rememberAuthor(n.account);
+        if (!actor || this.store.isBlocked(actor)) continue;
+        // The post a favourite or boost is about is one of this account's own,
+        // so it is mirrored first — a notification pointing at nothing is a
+        // row the client drops.
+        if (n.status?.uri) this._mirror(n.status, { acct: rec.id, parents });
+        if (n.type === 'favourite' || n.type === 'reblog') {
+          this.store.addNotification({
+            type: n.type === 'favourite' ? 'favourite' : 'reblog',
+            actor, noteId: n.status?.uri, via: rec.id,
+          });
+        } else if (n.type === 'follow' || n.type === 'follow_request') {
+          this.store.addNotification({ type: 'follow', actor, via: rec.id });
+          await this.onNotification?.(n, { actor, acct: rec.id });
+        } else if (n.type === 'mention') {
+          this.store.addNotification({ type: 'mention', actor, noteId: n.status?.uri, via: rec.id });
+          await this.onNotification?.(n, { actor, acct: rec.id });
+        }
+      }
+      if (notes.length && notes[0]?.id) this.setMarks(rec.id, { notifSinceId: String(notes[0].id) });
+    }
+
+    st.failures = 0;
+    return added;
+  }
+
+  // Two caps. The per-account one keeps a busy account from crowding out a
+  // quiet one; the total keeps every connected account together from evicting
+  // the pod's own posts and the timeline it already had.
+  _prune() {
+    const all = this.store.getStatuses();
+    const mine = all.filter(s => s.kind === 'acct');
+    if (!mine.length) return;
+    const drop = new Set();
+    const seen = new Map();
+    for (const s of mine) {
+      const acct = s.sourceAccts?.[0]?.acct || '?';
+      const n = (seen.get(acct) || 0) + 1;
+      seen.set(acct, n);
+      if (n > MAX_PER_ACCT) drop.add(s.noteId);
+    }
+    for (const s of mine.slice(MAX_ACCT_ENTRIES)) drop.add(s.noteId);
+    if (!drop.size) return;
+    this.store.write('statuses.json', all.filter(s => !drop.has(s.noteId)));
+  }
+}

package/lib/admin.mjs

@@ -39,6 +39,38 @@ const projectRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '
 const { makeGate } = require(path.join(projectRoot, 'vendor/gate.cjs'));
 
 const PHANPY_DIR = path.join(projectRoot, 'phanpy/dist');
+// The vendored client is upstream's build, byte for byte, so the integrity
+// check can say so. The two things it needs changed happen on the way out
+// instead of in the files.
+//
+// vite-plugin-pwa injects this registration into every page it builds. The
+// worker it installs answers navigations from a precache and replays the
+// headers stored at install time, so a CSP change can never reach a browser
+// that already has one.
+const SW_REGISTER = /<script id="vite-plugin-pwa:inline-sw">[\s\S]*?<\/script>/i;
+// Removing it stops new installs. This replaces the worker itself, so the ones
+// already out there clean up: browsers re-fetch sw.js on navigation and
+// install what they find. No fetch handler on purpose — a worker without one
+// never intercepts a request, so pages go straight to the network while it
+// runs.
+const SW_KILL = `self.addEventListener('install', () => self.skipWaiting());
+
+self.addEventListener('activate', (event) => {
+  event.waitUntil((async () => {
+    for (const key of await caches.keys()) await caches.delete(key);
+    await self.registration.unregister();
+    for (const client of await self.clients.matchAll({ type: 'window' })) {
+      try { await client.navigate(client.url); } catch { /* tab will refresh on its own */ }
+    }
+  })());
+});
+`;
+// Null rather than the original when the tag is gone: an upstream change that
+// silently no-opped here would put the worker back, which is the whole thing
+// this exists to prevent.
+function stripSwRegistration(html) {
+  return SW_REGISTER.test(html) ? html.replace(SW_REGISTER, '') : null;
+}
 const UI_DIR = path.join(projectRoot, 'ui');       // extra client dists: ui/<name>/ → /<name>/
 // Our own pages, kept out of ui/ for two reasons: a client dist dropped in
 // there under the same name would shadow them, and a group serves these and
@@ -81,6 +113,35 @@ const AGENT_VERSION = JSON.parse(fs.readFileSync(path.join(projectRoot, 'package
 // the case it exists for; it is in LOCAL_ONLY_POSTS below, so it still answers
 // only to this machine.
 const OPEN_POSTS = new Set(['/block', '/unblock', '/setup', '/setup/check', '/shutdown']);
+
+// The page the other server's redirect lands on. Self-contained on purpose:
+// the browser arrives here from somewhere else, and nothing may load from
+// that somewhere.
+function callbackPage(ok, msg) {
+  const esc = (s) => String(s).replace(/[&<>"]/g, c => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;' }[c]));
+  const head = ok ? 'Account connected' : 'Not connected';
+  return `<!doctype html>
+<html lang="en"><head><meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${head}</title>
+<style>
+  :root { color-scheme: light dark; }
+  body { font: 16px/1.7 system-ui, -apple-system, sans-serif; margin: 0;
+         padding: 2.5rem 2rem; background: #ffffff; color: #1a1a1a; }
+  main { max-width: 32rem; margin: 0 auto; }
+  h1 { font-size: 1.375rem; font-weight: 500; margin: 0 0 1rem; }
+  p { margin: 0 0 1rem; }
+  @media (prefers-color-scheme: dark) {
+    body { background: #16161a; color: #ececf0; }
+  }
+</style></head>
+<body><main>
+<h1>${head}</h1>
+<p>${esc(msg)}</p>
+<p>You can close this tab and go back to FediPod.</p>
+</main></body></html>
+`;
+}
 // Routes that manage a local agent process — spawning siblings, killing this
 // one, moving files on the machine, running setup in a browser. Inside a pod
 // server there is no such process and no such machine: identities come from
@@ -90,7 +151,7 @@ const EMBEDDED_CUT = new Set(['/profiles', '/shutdown', '/new-actor', '/start-ac
 // AP_ALLOWED_HOSTS may name a tailnet host or a reverse-proxy domain. The
 // fediverse is welcome there; creating accounts and editing the record is for
 // whoever is sitting at the machine.
-const LOCAL_ONLY_POSTS = new Set(['/setup', '/setup/check', '/config', '/new-actor', '/start-actor', '/shutdown', '/state-move', '/atproto/connect', '/gateway', '/alias', '/import', '/update']);
+const LOCAL_ONLY_POSTS = new Set(['/setup', '/setup/check', '/config', '/new-actor', '/start-actor', '/shutdown', '/state-move', '/atproto/connect', '/fediacct/connect', '/fediacct/disconnect', '/fediacct', '/gateway', '/alias', '/import', '/update']);
 // The identity itself. Changing any of these means a different actor at a
 // different address, which is a new setup, not an edit.
 const PERMANENT_CONFIG = ['handle', 'remotePod', 'issuer', 'root', 'kind'];
@@ -118,7 +179,10 @@ function inlineScriptHashes() {
   if (inlineHashes) return inlineHashes;
   inlineHashes = [];
   try {
-    const html = fs.readFileSync(path.join(PHANPY_DIR, 'index.html'), 'utf8');
+    // The page as it is SERVED, not as it sits on disk: hashing the
+    // registration script we strip would allow a script nobody gets.
+    const raw = fs.readFileSync(path.join(PHANPY_DIR, 'index.html'), 'utf8');
+    const html = stripSwRegistration(raw) ?? raw;
     for (const m of html.matchAll(/<script(?![^>]*\ssrc=)[^>]*>([\s\S]*?)<\/script>/gi)) {
       const digest = crypto.createHash('sha256').update(m[1], 'utf8').digest('base64');
       inlineHashes.push(`'sha256-${digest}'`);
@@ -296,7 +360,23 @@ function sendFile(res, baseDir, rel, auth) {
       res.writeHead(403); res.end(); return true;
     }
     const ext = path.extname(real);
-    const body = fs.readFileSync(real);
+    let body = fs.readFileSync(real);
+    // The vendored client, adjusted on the way out rather than in the files.
+    if (real.startsWith(fs.realpathSync(PHANPY_DIR))) {
+      if (path.basename(real) === 'sw.js') {
+        body = Buffer.from(SW_KILL);
+      } else if (ext === '.html') {
+        const stripped = stripSwRegistration(body.toString('utf8'));
+        if (stripped === null) {
+          console.error(`refusing to serve ${path.basename(real)}: no service-worker `
+            + 'registration to remove — the vendored client changed shape');
+          res.writeHead(500, { 'content-type': 'text/plain', ...securityHeaders(auth, false) });
+          res.end('the bundled client changed shape; refusing to serve it\n');
+          return true;
+        }
+        body = Buffer.from(stripped);
+      }
+    }
     // Our own pages are read straight off disk and change whenever the project
     // does. With no cache headers a browser is free to reuse them without
     // asking, so an edited page keeps rendering the old one and looks like the
@@ -511,6 +591,32 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
       if (req.method === 'GET' && p === '/blocks') return json(res, 200, agent.store.getBlocklist());
       if (req.method === 'GET' && p === '/log') return json(res, 200, { lines: agent.logLines(200) });
       if (req.method === 'GET' && p === '/deadletter') return json(res, 200, { items: agent.store.getDeadLetters() });
+      if (req.method === 'GET' && p === '/fediacct') {
+        return json(res, 200, { accounts: agent.fediaccts?.status() || [] });
+      }
+      // Where the other server sends the browser back. A GET, so it gets none
+      // of the POST branch's local-only protection for free and asks for its
+      // own — a code arriving from anywhere else is not the owner's.
+      if (req.method === 'GET' && p === '/fediacct/callback') {
+        if (!embedded && !allowed.isLocalRequest(req)) {
+          return json(res, 403, { error: 'connecting an account is available on this machine only' });
+        }
+        const q = new URL(req.url, 'https://x.invalid').searchParams;
+        const done = (ok, msg) => {
+          res.writeHead(ok ? 200 : 400, { 'content-type': 'text/html; charset=utf-8' });
+          res.end(callbackPage(ok, msg));
+        };
+        if (q.get('error')) return done(false, q.get('error_description') || q.get('error'));
+        if (!q.get('code') || !q.get('state')) return done(false, 'that sign-in came back incomplete');
+        try {
+          const row = await agent.fediaccts.complete({ state: q.get('state'), code: q.get('code') });
+          const cfg = agent.store.getConfig();
+          agent.store.setConfig({ ...cfg, fediAccounts: agent.fediaccts.roster() });
+          await agent.store.flush();
+          agent.restartAccts?.();
+          return done(true, `${row.handle} is connected.`);
+        } catch (e) { return done(false, e.message); }
+      }
       if (req.method === 'GET' && p === '/tagfeed') {
         return json(res, 200, agent.tagfeed
           ? { ...agent.tagfeed.config(), lastSweep: agent.tagfeed.lastSweep, lastAdded: agent.tagfeed.lastAdded }
@@ -613,6 +719,10 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
           atproto: cfg.atproto
             ? { ...cfg.atproto, connected: !!agent.atproto?.connected() }
             : null,
+          // Connected fediverse accounts, from the credentials themselves
+          // rather than from config — a roster entry whose file was deleted
+          // should stop being listed, not linger.
+          fediAccounts: agent.fediaccts?.status() || [],
           origins: {
             loopback: publicOrigin
               || `https://localhost:${port}/`,
@@ -1304,6 +1414,38 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
           await agent.store.flush();
           return json(res, 200, { ok: true, atproto: { ...cfg.atproto, crossPost: !!body.crossPost } });
         }
+        case '/fediacct/connect': {
+          // Starts the sign-in at the other server. Loopback-only, and the
+          // redirect returns to the origin the owner is actually using, not a
+          // guess — a client reaches this agent by several names.
+          if (!body.host) return json(res, 400, { error: 'the address of the server is required' });
+          try {
+            const { url } = await agent.fediaccts.begin({
+              host: body.host, redirectUri: `https://${req.headers.host}/fediacct/callback`,
+            });
+            return json(res, 200, { ok: true, authorize: url });
+          } catch (e) { return json(res, 400, { error: e.message }); }
+        }
+        case '/fediacct/disconnect': {
+          if (!body.id) return json(res, 400, { error: 'id required' });
+          if (!agent.fediaccts.remove(body.id)) return json(res, 404, { error: 'no such account' });
+          const cfg = agent.store.getConfig();
+          agent.store.setConfig({ ...cfg, fediAccounts: agent.fediaccts.roster() });
+          await agent.store.flush();
+          agent.restartAccts?.();
+          return json(res, 200, { ok: true });
+        }
+        case '/fediacct': {
+          // Non-secret settings only — today that is whether it is polled.
+          if (!body.id) return json(res, 400, { error: 'id required' });
+          const row = agent.fediaccts.setEnabled(body.id, !!body.enabled);
+          if (!row) return json(res, 404, { error: 'no such account' });
+          const cfg = agent.store.getConfig();
+          agent.store.setConfig({ ...cfg, fediAccounts: agent.fediaccts.roster() });
+          await agent.store.flush();
+          agent.restartAccts?.();
+          return json(res, 200, { ok: true, account: row });
+        }
         case '/archive': {
           // Whether drained mail's original bytes are kept in the private
           // half's inbox-archive/. Absent means on.

package/lib/bskygroup.mjs

@@ -30,7 +30,7 @@ export class BskyGroup {
   // ONE reply ever: tell an unbridged joiner how to reach the fediverse side.
   async nudge({ did, handle }) {
     const text = `@${handle} welcome! Follow @ap.brid.gy and your posts will reach `
-      + 'the fediverse side of this group too.';
+      + 'the Fediverse side of this group too.';
     const start = 0;
     const rec = this.atproto.read();
     await this.atproto.xrpc('com.atproto.repo.createRecord', {